Head-to-head · updated 13 September 2026

DataShield vs dbt: the models are tested, but who authorized the agent that read them?

dbt made analytics engineering a real field. It still owns the flow. SQL models in git. Tests that run in CI. A DAG you can read. A semantic layer sets a metric once. Two dashboards stop arguing. dbt Core is free. The new Fusion engine shipped as dbt Core v2.0 under Apache 2.0. That happened when the Fivetran deal closed on 1 June 2026. The combined firm now says it serves more than 100,000 data teams. If you build tables for a living, you likely run dbt. And you should.

We are not a build tool. DataShield governs the data sets agents read. We tokenize data sets at ingest. Agents query tokenized data over MCP. Detokenization is a locked, checked step. We tag fields against 129 PII, PHI, money and secret classes. Every governed tool call checks the agent's live rights first. It checks before the call runs. We seal the call into a hash chain anyone can check. Below is the honest split, with rows dbt wins too.

Get free Demo Center access Get an instant quote

The short version

Pick DataShield when

Someone will ask you to prove an agent's access log was not edited. An auditor, a checker, or Article 12 of the EU AI Act. Our chain answers with math, not a policy PDF. Run the verifier.
You need to pull an agent's rights mid-session. The very next tool call should fail. Not the next token swap. The next call.
The question is what is in the column, not how it was built. We tag fields against 129 PII, PHI, money and secret classes. Then we tokenize or broad-band what matters. See the catalog.
The vault, the rule calls and the proof all have to run on your own hardware, on keys you hold.

Pick dbt when

You need to build and test tables. That's the whole job dbt was made for. Nothing we ship stands in for a dbt project.
You want one meaning for revenue. The semantic layer, run by MetricFlow, hands every dashboard and copilot the same number. We don't set metrics.
Your team wants the workflow: version control, CI, docs, a DAG, and a wide set of packages and adapters for every warehouse you own.
You like the new engine. Fusion is Rust. It reads SQL on its own. It catches errors before they hit the warehouse. That's real engineering, and it's free.

Bottom line: dbt decides what the table means. DataShield decides which agent may read it, and keeps proof of what happened. Most teams that talk to us already run dbt. We've never once asked one to stop.

Feature by feature

Competitor cells state what dbt's public site, docs and press say. As of the date above. Did we get something wrong? Email support@myorg.ai. We'll fix it, credited.

What matters	DataShield	dbt	Edge
SQL transformation and testing	Ontology shapes data sets as one feature among ingest, catalog, checks, snapshot and lifecycle. It's not a build framework. There's no Jinja, no adapter set, no CI story for your models.	The reason this whole space exists. Models in git, schema and data tests, docs, a DAG, small builds. Plus the Fusion engine. It reads SQL on its own, in Rust. Static checks run before anything hits the warehouse.	◇
Semantic layer and metrics	We build a business glossary from entity types, using ISO/IEC 11179 data-element ideas. That's a word list, not metric logic. We don't work out your revenue rule.	MetricFlow. Set a metric once, in YAML. Serve it to BI tools, apps and agents. Top features sit at Enterprise and up.	◇
Sensitive data classification	129 field classes cover PII, PHI, money data and secrets. Fixed and repeatable, with all 18 HIPAA Safe Harbor IDs tied to a rule. We scan and check a live PostgreSQL source in place, with no rows leaving it. That's PostgreSQL today, not your whole estate.	Out of scope. Their security page says plainly that "Data remains in your data warehouse, we don't upload or download it." Whether a column holds patient data is yours to know, and yours to handle in SQL.	◆
Tokenization and masking	Fixed, join-safe, vault-reversible tokens, set at ingest. Plus broad bands for quasi-IDs. Dates become year, decade or age band. ZIPs become 3 or 4 digits. Phones, SSNs and emails get part masked. Each column gets a risk score. Features you switch on, not defaults.	Not a product feature. You can hash or mask in a model, and plenty of teams do. But key handling, the flip-back path and the audit around it are all your own work.	◆
Audit evidence	SHA-256 hash chain with Ed25519-signed checkpoints that are chained too. A check comes back clean, flagged, or tampered. It names the fault: tampering, insertion, deletion or a cut. Try the verifier.	Job and query logs, run files, and an admin API. Handy for fixing a build. We found no tamper-proof record of which agent read which table.	◆
Agent authorization	Every governed tool call passes a consented-tool allowlist and a scope ceiling. A set rights tier and a mid-session pull check come before dispatch. It fails closed.	The MCP server logs in with OAuth or a token, and serves models, metrics, lineage and freshness. Their docs call governed access a matter of steady context. We found no per-call rights check.	◆
Break-glass	Scoped, time-boxed access, just for a crisis, just for agents. It auto-revokes. It can't be quietly wiped from the log.	Not listed in their public docs.	◆
GDPR erasure	Crypto-shred of per-person key parts, tied to ISO/IEC 27040 and GDPR Article 17. Plus ISO 27560 consent receipts. The audit chain still checks out after.	They hold job metadata, not your rows. Less to erase on their side. They don't list a per-person erasure method. Dropping the person is a job for whatever holds the data.	◆
MCP and agents	More than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. Auth hands out MCP tool tokens with scope ceilings. It logs each call, ties it to the agent, and seals an audit row. Delegation uses RFC 8693 token exchange, with a fixed scope ceiling.	A real MCP server in two forms, self-hosted and remote. It covers CLI commands, the Semantic Layer, SQL runs, metadata search and the admin API. Plus Agents Schema, an open standard. It points agents at one shared context schema in your warehouse.	◆
Catalog and lineage	Asset and column metadata, a built glossary. Typed lineage paths, with per-hop access gating. Plus a 29-step steward flow. Lineage comes from the pipelines that own it. Not a stored graph.	dbt Catalog, plus lineage built from the DAG you already wrote. The cheapest true lineage anyone has shipped. Advanced Catalog is Enterprise and up.	◇
Deployment	Self-hosted, in your own cloud or room. Or on a single-tenant box we run for you. Docker images ship for Auth, Ontology, Corpus and Lighthouse. Guardian checks a signed deploy file first. Ed25519 audit-signing keys sit on your box, in a key folder you hold. Key turnover uses kid keys. It fails closed on an unknown key. KMS or HSM custody is a built gap in Auth. Not a shipped link. HMAC tokenization keys sit as files on your box today. Not in a KMS.	dbt Core runs anywhere you can run a CLI, which is a truly free self-hosted path. The platform is SaaS. PrivateLink, IP limits and hybrid projects show up only at Enterprise+.	◈
Open source	Not open code. You get Docker images and a signed deploy file. Source escrow comes in design-partner terms.	dbt Core is free. Fusion shipped as dbt Core v2.0 under Apache 2.0, at the merger close. A real promise, kept in public, after a deal that made people nervous.	◇
Maturity signals	Auth, Guardian and Lighthouse are live and in use. Guardian and Lighthouse have run since April 2026. SOC 2 is not yet in place, and we say so.	Founded 2016. Made this space. Merged with Fivetran on 1 June 2026, into a firm that claims more than 100,000 data teams. Their security page cites ISO 27001, ISO 27701 and ISO 42001 as guide standards.	◇
Pricing	Published price, a quick quote, no sales wall.	Developer is free. Starter is $100 per user per month, with 15,000 models and 5,000 queried metrics. Enterprise and Enterprise+ are quote only. That's where the catalog, semantic layer, Mesh and the network rules live.	◈

◆ DataShield leads◇ dbt leads◈ comparable

dbt claims come from getdbt.com, docs.getdbt.com and Fivetran press notes, last checked 13 September 2026. We link them below, not just from memory.

Three things you get here that you won't get from a transformation tool

Proof that survives an audit

A log you can quietly edit proves nothing. Ours is a hash chain with signed checkpoints. The verifier names what broke, not just that it did. It even tells old flagged damage apart from a fresh tamper. That's the trait EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Try it in your browser, no signup.

Authority that can change mid-flight

An analyst hands in her notice on a Friday. Her agent is 20 minutes into a 40-minute job. With DataShield, the next governed tool call checks live rights and fails closed. Your dbt tests stay green the whole time, since the tables are fine. The tables were never the problem. How Auth does it.

A view of what is actually in the column

"Data stays in your warehouse" is a fine answer to a security review. It's no answer at all when someone asks if an agent read PHI last Tuesday. We tag fields against 129 classes, and mark the 18 HIPAA Safe Harbor ones with a rule tie. We can tokenize or broad-band them before an agent sees a row. See the classification story.

Where dbt is genuinely stronger

Let's be fair. dbt changed how data teams work, and the change stuck. Version control, tests, CI and code review were normal in software. They were rare in analytics, until dbt made them the norm. The free Core tier is not a crippled trial. It's the real tool. The Fusion engine is a serious piece of work. Rust, native SQL reads. Static checks that catch a broken tie before your warehouse bills you for it. The Fivetran deal closed on 1 June 2026. They open sourced Fusion as dbt Core v2.0, under Apache 2.0. That's the opposite of what most people feared. Tristan Handy kept the notes short. He kept the license promise in public, too. The semantic layer is the right idea too. One metric, served everywhere, beats another dashboard for most AI work.

Here's the push-back. Agents Schema bets that agent trust is a context problem. Put the right shared schema in the warehouse, and agents will behave. Context helps. It's not enough on its own. A well-set metric tells you nothing about this: is this agent, right now, allowed to see the rows behind it? The dbt MCP server can run SQL. Its docs call governed access steady access to models, metrics, lineage and freshness. That's steady, not checked. There's no per-call check point we could find. No mid-session revoke. No proof file a checker could test on its own. One more thing worth naming. Fivetran took over Great Expectations on 13 May 2026, then closed the dbt merger three weeks later. One firm now owns your intake. Also your build step. Also the best known open source data quality tool.

That's not a reason to drop dbt. It's a good reason to keep your proof layer somewhere else.

Questions worth asking both of us

These are the questions we would want answered if we were the ones buying. Ask them on every call, ours included.

Can you cryptographically prove an audit log entry wasn't deleted?

DataShield: yes. Each record ties to the one before it. Checkpoints are Ed25519-signed and chained to each other. A check tells delete apart from a cut and from a tamper. Run it against a sample chain at /verify. dbt: their platform keeps job logs, query logs, and run files. Built for fixing builds. We found no tamper-proof access record. Ask them to show one.

What happens to a revoked agent mid-session?

DataShield re-checks rights on every governed tool call. Revocation lands on the next call, not the next token swap. The dbt MCP server uses OAuth or token auth, and can run SQL. Their public docs don't list session revoke or a per-call scope check. Ask how long a pulled key keeps working, and ask about the remote server by name.

How does GDPR erasure interact with the audit trail?

DataShield crypto-shreds the per-person key parts, which wipes every ciphertext for that person at once. It sends an ISO 27560 consent receipt too. Actor names in the chain carry an HMAC lock. The proof still checks out. Even once the person is gone. dbt holds metadata, not rows. The erasure question lands on your warehouse instead. Ask what's in the job and query logs, and who can read them.

Is DataShield a dbt alternative? Do we stop running dbt?

No, and no. We don't model your warehouse. There's no Jinja, no adapters, no CI flow for your SQL. We're not going to build one. Keep dbt. Run us for the governed data sets agents read, where the job is tagging, rights and proof. The two tools meet at one spot only. The MCP surface an agent calls.

dbt ships an MCP server and Agents Schema. What's different about yours?

Theirs gives an agent context. Models, metrics, lineage, freshness. A shared schema in your warehouse to read from. Good build for a transform platform. Ours is where agents query the governed data itself. The tool token carries a scope ceiling. We check and log the call before dispatch, and seal the call into the chain. Ask an agent what revenue means using theirs. Let an agent read a patient table using ours.

The Fivetran merger closed. Does that change anything for us?

For dbt users, mostly in a good way so far. Fusion went Apache 2.0, the license promise held, and intake and build steps now come from one vendor. The thing to watch is scale. That firm also stewards Great Expectations. Your pipeline, your models, your quality checks: one roadmap owner. Ask them where agent rights sit in that roadmap, and who owns it.

Does DataShield have SOC 2?

Not yet. We won't say otherwise. dbt's own security page cites ISO 27001, ISO 27701, ISO 42001. These guide their program. Ask them straight what they hold, not just what guides them. What we offer is a public threat model, and a verifier anyone can run. Design partner terms include source escrow. One small vendor is not a single point of failure. Auth, Guardian and Lighthouse are live and in use, Guardian and Lighthouse since April 2026. Details on the security page.

Fivetran and dbt Labs completed their merger on 1 June 2026, with the Fusion engine runtime "released as dbt Core v2.0 under an Apache 2.0 license" and the combined company serving "more than 100,000 data teams globally." - Fivetran press release, 1 Jun 2026
Agents Schema is described as "an open source standard for agentic context" that "designates a single schema in the warehouse or lake as the shared context layer for AI agents." - Fivetran press release, 1 Jun 2026
The dbt MCP server "ensures consistent, governed access to models, metrics, lineage, and freshness across your AI tools," ships self-hosted and remote, and provides SQL execution and the Semantic Layer. - docs.getdbt.com, 13 Sep 2026
dbt Labs on customer data: "Data remains in your data warehouse, we don't upload or download it," with ISO 27001, ISO 27701 and ISO 42001 cited as standards guiding the security program. - getdbt.com/security, 13 Sep 2026
Merger announcement: combined ARR of roughly $600M, and a commitment that "dbt Core and Fusion will both continue to be shipped under their current licenses." - dbt Labs blog, 13 Oct 2025
Published pricing: Developer free with 3,000 models per month; Starter $100 per user per month with 15,000 models and 5,000 queried metrics; Catalog, Semantic Layer, Copilot, Canvas, Insights and Mesh at Enterprise and above. - getdbt.com/pricing, 13 Sep 2026
Fivetran became steward of the Great Expectations open source community. Also the GX Core project, three weeks before the dbt merger closed. - Fivetran press release, 13 May 2026

Other head-to-heads

Same market

Get free Demo Center access

You've seen the proof

Ready for a number? Scope your deployment and we'll price it against your own economics.

Get your quote →